fix(linux): prevent AppImage env from breaking curl-based agent installers and stop false UI success

[cursor]

Describe Your Changes

• Sanitize AppImage runtime environment before spawning host processes.
  apply_login_path now calls sanitize_appimage_env, which removes the
  AppImage-injected LD_LIBRARY_PATH, APPDIR, and other runtime variables
  from spawned commands. This stops system curl/npm/node/MCP servers
  from loading the bundled (older) OpenSSL and breaking with symbol errors.
  The same list is also applied to MCP stdio server spawns in
  src/core/mcp/helpers.rs.

• Use bash with pipefail for Unix curl-based agent installers.
  goose, hermes, poolside, and zed Unix install commands now run as
  bash -c 'set -o pipefail; curl -fsSL ... | ...' instead of sh -c '...'.
  A failed curl now aborts the pipeline with a non-zero exit code instead of
  being masked by the trailing shell exiting cleanly on an empty script.

• Return the post-install detection result in the Launch UI.
  installAgent now returns await detect(agent) and only shows the success
  toast when the binary is actually found. This prevents the UI from
  reporting a successful install when the installer failed silently.

• Add regression test for sanitize_appimage_env ensuring it removes all
  AppImage runtime variables from a spawned command.

Fixes Issues

• Closes ATO-416

Self Checklist

• Added relevant comments, esp in complex areas
• Updated docs (for bug fixes / features)
• Created issues for follow-up changes or refactoring needed

Note: this is a targeted bug fix that does not change user-facing docs.